Security and trust

OpenTodo runs on your server, so you should be able to check every claim it makes. Here is where to look, including what it does not protect.

Found a problem?

Report a vulnerability privately
Through GitHub’s private reporting, or by email as the security policy says. You get an answer within a few days, and fixes credit the reporter.

Security policy
The security model in full: accounts, sessions, tokens, roles, what the server stores and what it never sends anywhere.
Account security
Passkeys, two-factor authentication, and where your account is signed in.
End-to-end encryption
What is encrypted on your devices, what is not, and the threat model it is built for.
No telemetry
The app sends nothing to the OpenTodo project. Beyond your server it reaches only the services you configure and, while maps are on, the map provider through your server, which the owner can change or turn off.

Verify the image and downloads
Every image is signed with cosign and carries an SBOM and build provenance; every release file has an attestation and a checksum.
Verify the Android app
One signing certificate for Google Play, F-Droid and GitHub, and a reproducible build you can compare with the source.
Read the source
Every line of the app, its specifications and its tests, under the AGPL-3.0.

Threat model
Who could attack an OpenTodo server, what they could reach, what stops them and which tests would fail if it broke, and what is not defended.
How we verify security
The tests, fuzzing, static analysis and checks behind each claim, every past security fix, and the gaps still open.
Security limits
What OpenTodo does not protect, in one place: what the operator can see, what is unencrypted at rest, what backups hold, and how far host mode and the demo isolate.
Independent review scope
The brief prepared for an outside security review. No external review has taken place yet, and none is claimed.
Disclosure policy
An answer within 3 business days, an assessment within 10, fix targets per severity, coordinated disclosure within 90 days with an advisory and a CVE, and a safe harbour for research on your own server.